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?S ei l£^ 2 USAGE DATA RECORDING SYSTEM AND METHOD EMPLOYING DISTRIBUTED 
DATA PROCESSING AND DATA STORAGE — 

IN THE CLAJMS 

Amcndnif "" «he Claims 

This Usting of claims wiU replace all prior versions, and listings, of the claims: 

1. (Currently Amended) A network usage system having a multiple level distributed data 
storage system, the system comprising: 

a set of first level network data collectors, therein each first level network data collector 
receives network accounting data from a network data source, processes and 
stores the network accounting data at the first level network data collector; and 
a second level network data coliector, wherein the second level network data collector 

receives processed network accounting data from one or more first level network 
data collectors, processes and stores the network accounting data at the second 
level network data coUectoxTiand 
«Hw«m each fw networ k d,t, rolle r include n fir* levrl data storage system 
^ ^ ^onH level net work rlitf, r-o. lentor includes a secon d level data stora ge sy stem 
^ ^ssed network mnntin* Am, wherein the first le.vel data storay. system and the 

wi <U« a storage ^smni^u^ ^ vrnr^A data storagejocatipn^ 
c ^o, Incario P ™ recovery informnrion stor^ lor-nion wherein the processed 
network accor-^™ " "tor ed fit t he pr oc e ssed rtatn storage location. 

2 (Original) The system of claim 1, farther comprising a third level network data collector, 
wherein the third level network data collector receives processed network accounting data from 
the first level network data coUector or the second level network data collector, processes and 
stores the network accounting data at the third level network data collector. 



2 



PAGE 6/23 1 RCVD AT 1(24/20054:33:45 PM [Eastern Standard Time] ' SVR:USPT0-EFXRF-1/2 1 DN1S:8729306 * CS1D:61 25732005 * DURATION (mm-ss):07-12 



01/24/2005 16:39 FAX 6125732005 



.PICKE.BILLIG&CZAJA P. A. 



01007 



Amendment and Response 

Applicant AlexanderC.Ranousetal. 
Serial No.: 09/559,693 
Filed: April 27. 2000 

SISSUSAGE DATA RECORDING SYSTEM AND METHOD EMPLOYING DISTRIBUTED 
DATA PROCESSING AND DATA STORAGE 

3 (Original) The system of claim 2, further comprising an application interface which 
receives processed network accounting data from the first level network data collector, the 
second level network data collector, or the third level network data collector. 

4 (Original) The system of claim 1. wherein the first level network data collector includes 
a query manager, and wherein the second level network data collector is in communication with 
the first level network data collector via the query manager. 

5. (Original) The system of claim 1 , wherein the first level network data collector converts 
the network accounting data to a standard data format. 

6. (Cancelled) 

7. (Cancelled) 

8 (Currently Amended) The system of claim *L wherein after storing of the processed 
network accounting data, corresponding metadata is transferred to the metadata storage location 
and error recovery information is transferred to the error recovery information location. 

9. (Currently Amended) The system of claim 61. wherein the first level data storage system 
includes a first level aging policy, wherein network accounting data is removed from the first 
level data storage system after a time period corresponding to the first level aging policy. 

10. (Original) The system of claim 9, wherein the second level data storage system includes 
a second level aging policy different from the first level aging policy, wherein the network 
accounting data is removed from the second level data storage system after a time period 
corresponding to the second level aging policy. 
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1 1 . (Withdrawn) A network usage system having a multiple level distributed data storage 

system, the system comprising: 

a first network data collector including a first encapsulate*, a first aggregator, and a first 

data storage system; 

a second network data collector including a second encapsulator, a second aggregator, 
and a second data storage system; and 

a data correlator collector including a third encapsulates a third aggregator, and a third 
data storage system, wherein the third encapsulator is in communication with the 
first data storage system and the second data storage system. 

12 (Withdrawn) The system of claim 1 1, further comprising an aggregator collector 
including a fourth encapsulator, a fourth aggregator, and a fourth data storage system, wherem 
the fourth encapsulator is in communication with the third data storage system. 

13 (Withdrawn) The system of claim 1 1, wherein the first data collector receives network 
data from a network data source, and wherein the first aggregate processes the network data. 

14. (Withdrawn) The system of claim 13, wherein the processing of the network data 
includes the process of performing data reduction on the network data. 

15 (Withdrawn) The system of claim 1 1, wherein the first data collector receives network 
data from a network data source, and wherein the first encapsulator converts the network data to 
a standard data format. 

16 (Withdrawn) The system of claim 11, wherein the first aggregator processes the network 
data providing aggregated data, and wherein the first aggregator includes a defined data transfer 
interval such that me first aggregator transfers the aggregated data to the first data storage system 
at the data transfer interval. 



4 



PAGE 8/23 ' RCVD AT 1/24/2005 4:33:45 PM [Eastern Standard Time] ' SVR:USPT0-EFXRF-1/2 ' DN1S:3729306 ' CSfl):6125732005 * DURATION (mm-ss):07-12 



01/24/2005 16:40 FAX 6125732005 



DICKE.BILL IG&CZAJA P. A. 



©009 



Amendment and Response 
Applicanc Alexander CRanous el al. 
Serial No,: 09/559.693 
Filed: April 27, 2000 



Filed: Apnw/.-ww 

INTER^^T US AGE DATA. RECORDING SYSTEM AND METHOD EMPLOYING DISTRIBUTED 
DATA PROCESSING AND DATA STORAGE " 



aggregated data at the query interval. 

18 . (Withdrawn) The system of claim 17, wherein the data transfer interval is a multiple of 

the query interval. 

19 (W^drawn) 

abated data ^U^.-^^^^-"^ 1 -^ 

slge location, wherein the abated data is stored at the aggregated data storage locaUon. 

20 (Withdrawn) Tta^of d-ml^^^t^^W^^^ 

^datastorage system, corresponding metadata* hansferred to the metad«e location 
and error recovery information is transferred to the error recovery information location. 

21 (Currently Amended) A method for recording network usage including storing network 
data in a multiple level data storage system, the method comprising the steps of: 

defining a set of first level network data collectors; 

receiving a first set of network accounting data at each first level network data collector, 
processing and storing me first network accounting data set at me first level 

network data collector; 
defining a second level network data collector; 

receiving *e first network accounting data set from one or more first level network data 
collectors, processing the first network accounting data set to produce a second network 
counting data set, and storing the second network accounting data set at the second level 
network data collector^ 
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. w w.l noli c v Fo r the fir st level network dnta collector: nnd removing 

w n.rwnrk ac~ ™ ? Hm. set from the first level network H ? „* collector after a time 

ptr pnH ftorrt - e^riina to fr» r R™t level nring policy. 

22. (Original) The method of claim 21, farther comprising the steps of: 
defining a third level network data collector; and 

receiving the second network accounting data set at the third level network data collector 
from the second level network data collector, processing the second network 
accounting data set to produce a third network accounting data set, and storing the 
third network accounting data set at the third level network data collector. 

23 (Original) The method of claim 21. further comprising the step of defining an application 
interface-, and receiving the second network accounting data set at the application interface. 

24. (Original) The method of claim 21, further comprising the step of defining the fust level 
network data collector to include a query manager, wherein the second level network data 
collector is in communication with the first level network data collector via the query manager. 

25 (Original) The method of claim 21, wherein the step of processing and storing the first 
network accounting data set via the first level network data collector further comprises the step 
of converting the first network accounting data set to a standard data format. 

26. (Original) The method of claim 21, further comprising the step of defining the first level 
network data collector to include a first level data storage system having a first processed data 
storage location, a metadata storage location and an error recovery information storage location, 
wherein the first network accounting data set is stored at the first processed data storage location. 
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27 (Original) The method of claim 26, further comprising the steps of transferring metadata 
to the metadata storage location and transferring error recovery information to the error recovery 
information storage location after storing the processed first network accounting data set. 

28. (Cancelled) 

29 (Currently Amended) The method of claim M2L flmto comprising the step of defining 
a second level aging policy for the second level network data collector, wherein the second level 
aging policy is different than the first level aging policy. 

30. (Withdrawn) A network usage recording system having a multiple level distributed data 

storage system, the system comprising: 

a set of first level network data collectors, wherein each first level network data collector 
receives network usage information from a network data source, processes and 
stores the network asage information at the first level network data collector, 
including converting the network usage information to a standard data format; and 
a second level network data collector, wherein the second level network data collector 
receives processed network usage information converted to the standard data 
format, from one or more first level network data collectors, processes and stores 
the network usage information at the second level network data collector. 

31. (Withdrawn) The system of claim 30, further comprising a third level network data 
collector, wherein the third level network data collector receives processed network usage 
information converted to the standard data format from the first level network data collector or 
the second level network data collector, processes and stores the network usage information at 
the third level network data collector. 
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32. (Withdrawn) The system of claim 30, wherein the network usage information comprises 
at least one of network usage data or network session data, comprising at least one of a source IP 
address, a destination IP address, byte counts, packet counts, a time stamp and a username. 

33. (Withdrawn) The system of claim 30, wherein each first level network data collector 
comprises an encapsulated an aggregator, and a data storage system, and the second level data 
collector is a correlator collector including an encapsulator, an aggregator, and a data storage 

system. 

34. (Withdrawn) The system of claim 33, wherein the first level encapsulator converts the 
network usage information to a standard data format, and the aggregator processes the converted 
network usage information including performing data reduction to provide aggregated data. 

35. (Withdrawn) The system of claim 34, further comprising a query manager in 
communication with the first level network data collector and the second level network data 
collector, and each aggregator includes a data transfer interval such that the aggregator transfers 
aggregated data to the data storage system at the data transfer interval, the query manager 
including a query interval where the second level data collector queries the first level data 
storage system for the aggregated data at the query interval via the query manager. 

36. (Currently Amended) A method for recording network usage including storing network 
data in a multiple level data storage system, the method comprising the steps of: 
defining a set of first level network data collectors; 

receiving a first set of network usage information at each first level network data 

collector, processing and storing the first network usage information set at the 
first level network data collector; 

defining a second level network data collector;-a«d 
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receiving the first network usage information set at the second level network data 

collector from one or more first level network data collectors, processing the first 
network usage information set to produce a second network usage information set, 
and storing the second network usage information set at the second level network 
data collectoiriand 
rtrfir8 . r .».- 1«vel nrt w ~* <*<«* ™"<** 0 r tn inrlnrte * query man^pr; 

■ hn . Hr ^ "''""^ 1^.1 nsiwo rlr rinn rol ler iw in communication with the fiysy 
i-„a1 rework data coH ^tnr via the query fflanageju 

37 (Previously Presented) The method of claim 21, where processing the first network 
usage information set includes converting the first network usage information set to a standard 
data format, and aggregating the converted first network usage information set. 

38 (Previously Presented) The method of claim 2 1, where receiving the first set of network 
usage information includes defining the network usage information to comprise at least one of 
network usage data or network session data. 

39 (Previously Presented) The method of claim 21. further comprising querying the first 
level network data conector for the processed network usage information stored at the first level 
network data collector; and transferring the processed network usage information to the second 
level network data collector. 

40. (Currently Amended) A networkusage system having a multiple level distributed data 
storage system, the system comprising: 

a set of first level network data collectors, wherein each first level network data 
collector receives network accounting data from a network data source, processes and stores the 
network accounting data at the first level network data collector, where each network data 
collector is configured to receive network accounting data including at least one of network 
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usage data comprising source address, destination address, byte or packet counts and a time 
stamp, or network session data comprising a source address, a time stamp and a user name; W | 

a second level network data collector, wherein the second level network data collector 
receives processed network accounting data from one or more first level network data collectors, 
processes and stores the network accounting data at the second level network data collector,; 

where" first lev*! network data rnllActor includes a first level dam storage sysrem , 
the, second i™J ^rwork dat E ^lteciftr includes a second level dnia storape system J or 
^nrin.nmcesH n^wnfk accn u nring data, wherein (he first level d i tq storage system and the 
^ond level d»t« ^nm« svste r" include a processed data storage location, a mcta data 
«nn,«« location »nd „n e.rror re c ^rv information storawe location wh , erpin the processed 
network account™ dnm is svoreH a t th P . ^ dafH storage location wherein after storing o f 
the process network account! ™ Hat* corresponding meta data is transferred to the meta data 

location »»* «rmr recove r y ™farm.,ti«n is transferred to the error recovery informatio n 
location: 

wherr-in ftach first levrf network data Elector includes a query manager, and wherein the 
rarwid level n ^ wm-k d«na colla r i« in commimication with the first level network da ta 
^nllftrinr via me an fttv manager: and 

wher™ r.«rh of the P «t level dam strmtpe systems include a first level aging policy, 
wh^in network hunting dat a i« amoved from the first level data siowpft aftCT a ^ 

p^ri^ rorresDO^ina rr, the first i^i pfKrt. policy and wherein the second level data stprage 
astern include ° level nolicv different from the first level a piny policy, where j n 

the network ar -™™iin„ data is r^nved from the second level data star bp* system after a tim e 
period corresponding to the seco nd level aging policy. 

41 . (Previously Presented) The system of claim 40, where each first level network data 
collector is configured to receive network accounting data from an Internet network data source. 
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42. (Previously Presented) The system of claim 40, where each first level network data 
collector is configured to receive network accounting data from an intranet network data source. 

43. (Previously Presented) The system of claim 40, where each first level network data 
collector is configured to receive network accounting data from a telephony network data source. 
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